CVE-2026-125222
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
30/100
Published: 2026-11-09
Modified: 2026-11-13
First seen: 2026-11-09
Status: active
Attack Surface
No Auth
Conf. Impact
Integ. Impact
CVSS Vector Breakdown
AV:
Local
AC:
High
PR:
None
UI:
Passive
AT:
Present
VC:
High
VI:
High
VA:
High
Description
FFmpeg through 9.0.2 contains an integer overflow vulnerability in hap_parse_frame_header() in libavcodec/hapdec.c that allows attackers to trigger a heap buffer overflow on 32-bit builds. Attackers can craft Hap video frames with Snappy length prefixes that wrap tex_size, causing decompress_chunks_thread() to write outside tex_buf and crash the application or potentially execute code.